Mshta Remote Payload Execution

Brandon Rodriguez@BMRodriguez

•updated May 22, 2026•2•0•78

Identifies instances of mshta.exe being used to execute remote payloads over HTTP/HTTPS. This matches the initial ClickFix access vector used in the Amatera Stealer campaign.